The curl command is pretty wrong.
You're still not passing an Authorization header. -H by itself doesn't turn the
value into one. You're also submitting JSON data, not form data. The server
won't be able to recognize any of that.